[Dshield] Possible Virus......??

Lane Weast lweast at leeclerk.org
Mon Mar 18 13:51:16 GMT 2002


More details please.
What type of attachment was it?
Can you get a copy of the full email source for posting and analysis?
We block all .exe .scr .vbs and several others, was this a mime
vilnerability launching the web site?

Feed me semore!
 Lane Weast

> -----Original Message-----
> From: James Jarvis [mailto:james.jarvis at quest-media.com]
> Sent: Monday, March 18, 2002 5:37 AM
> To: 'list at dshield.org'
> Subject: [Dshield] Possible Virus......??
> 
> 
> Hi there,
> 
> One of my colleagues received an email from test at test.com.tw 
> when the email
> was opened it launhed a web-site and commenced downloading a file - It
> didn't display the name of the file, and the download was 
> cancelled before
> it was able to continue. I checked the source of the email 
> (It was in HTML)
> and it pointed to a site called callin.net. The remainder of 
> the email was
> all in stragnge random characters, and there was a type of 
> form at the base
> of the email.
> 
> I ran a virus scan on the computer (McCafee) and it didn't 
> find anything
> unusual. Does anyone have any thoughts? It may be completely 
> harmless, but I
> am not a fan of executable emails. Was thinking of sending the URL to
> McCaffee suport, for them to investigate.
> 
> Thanks,
> James
> 
> _______________________________________________
> Dshield mailing list
> Dshield at dshield.org
> To change your subscription options (or unsubscribe), see: 
> http://www.dshield.org/mailman/listinfo/list
> 




More information about the list mailing list